Most "outdated dependency" tools want an install, an account, or a CI integration. Sometimes you just want to open a project you haven't touched in months and see what has moved.

I wrote a small Python script for that, packaged as a Hermes skill. It uses only the standard library and the public PyPI and npm registry endpoints, so there is no API key and nothing to install.

It reads a requirements.txt or package.json, takes the pinned version of each package, asks the registry for the latest one, and sorts the result by risk: major updates first, then minor, then patch. Packages it can't judge (loose ranges like >=2.0, dist tags like latest) are labelled unpinned rather than guessed at. A package the registry doesn't know shows lookup-failed (HTTP 404) instead of crashing the run.

$ python3 scripts/depwatch.py package.json PACKAGE PINNED LATEST STATUS express 4.0.0 5.3.0 major left-pad 1.0.0 1.3.0 minor

Add --fail-on-major and it exits with code 1 when a major bump exists, which is handy in a scheduled job. --json gives structured output.

It's deliberately limited: it compares version numbers, not changelogs, so it can't tell you if an upgrade really breaks anything. It skips transitive dependencies and lock files. Treat the output as a to-do list for reading release notes, not as a verdict.

An offline --selftest covers the version parsing and classification logic.

Skill (MIT): https://github.com/RobinBeraud/hermes-skills/tree/main/software-development/dependency-update-watch
All skills: https://github.com/RobinBeraud/hermes-skills

This post was written with AI assistance and reviewed through automated checks.